Identity: ECDSA P-256
ECDSA signs and verifies data with a public/private key pair. The identity layer uses public-key-derived identity and signature verification to associate operations with key material.
Key agreement: ECDH P-256
ECDH lets two parties derive shared key material without transmitting the final symmetric key across the network.
Key derivation: HKDF-SHA256
HKDF turns key material into keys suitable for specific cryptographic purposes. Context-specific derivation helps separate uses of key material.
Authenticated encryption: AES-256-GCM
AES-256-GCM provides confidentiality and integrity when used with correct key and nonce handling. Modified ciphertext should fail authentication.
HTTPS/WSS is still necessary
Application encryption does not replace TLS. HTTPS/WSS authenticates the service endpoint and protects network traffic in transit.
How to read the encryption model
Chat256 uses established cryptographic primitives for specific jobs: signatures authenticate application actions, ECDH establishes shared key material, HKDF derives encryption keys, and AES-256-GCM protects supported message content. Understanding the role of each layer makes the security model easier to evaluate and use correctly.